@holmes-lab/holmes-kit 0.7.0 → 0.7.1

package/CHANGELOG.md

@@ -4,6 +4,34 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+<!-- @implements A-SPEC-209 -->
+## [0.7.1] - 2026-09-02
+
+An adversarial self-review of the seven-language work — 42 probes the test suite never pinned
+(hostile syntax through every new lowering, taint false-positive/negative controls, import
+boundary and escape attempts). The strong properties held: zero crashes, zero invariant
+violations, zero out-of-scan escapes, and the sanitizer's exact-match fail-open was confirmed
+correct. Four low-severity harvest items were fixed; every keep-as-is verdict carries its
+measurement.
+
+### Fixed
+
+- **Labeled statements are breakable** (REQ-527): Java (and TS) allow `break L` out of ANY
+  labeled statement; the lowering registered only loops and switches, so the legal
+  `L: { … break L; }` refused the whole function. The labeled statement now owns its label's
+  breaks (loops/switches keep consuming labels as before; `continue` stays loop-only, as in the
+  languages themselves).
+- **Two taint sources stopped bleeding through substrings** (REQ-527): C++'s bare `cin` matched
+  inside ordinary identifiers (`racing`, `medicine`…), C#'s bare `Form` matched every `*Form`.
+  Now `std::cin`/`cin >>` and `Request.Form`/`.Form[` — the adversarial probes are regression
+  tests, and the positive controls prove the real reads still fire. **Corpus re-verification:
+  identical numbers everywhere** (violations 0, C++'s two genuine findings kept, all five
+  import-arrival counts unchanged — no legitimate signal was lost).
+- **Two wrong-frame import resolutions refuse** (REQ-527): an absolute `#include "/…"` no longer
+  normalizes into the repository frame, and `super::` beyond a Rust crate root resolves to
+  nothing (rustc calls it an error too). Both could only ever hit scanned files — wrong
+  coordinates, not escapes — and now hit none.
+
 <!-- @implements A-SPEC-209 -->
 ## [0.7.0] - 2026-09-02
 

package/dist/.build-id

@@ -1 +1 @@
-7cb32c4-mtjifuwa
+9196dd1-mtk1gito

package/dist/holmes/cpg/foundation/cfg.js

@@ -325,8 +325,31 @@ function cfgOf(ast, fn, source) {
                     return lowerSeq(stmtChildren(i), ctx);
                 case 'labeled_statement': {
                     const [labelNode, inner] = [kids.of(i)[0], stmtChildren(i).at(-1)];
-                    ctx.pendingLabel = labelName(labelNode);
-                    return lowerStmt(inner, ctx);
+                    const lname = labelName(labelNode);
+                    // @implements A-SPEC-527.1 — Java (and TS) allow `break L` out of ANY labeled
+                    // statement, not only loops and switches. Loop/switch inners keep consuming the label
+                    // themselves (their break machinery owns the exits); for every OTHER statement the
+                    // labeled statement itself becomes the breakable, and its parked breaks exit past it.
+                    // `continue` is deliberately NOT registered — the language keeps it loop-only too.
+                    const LABEL_CONSUMERS = new Set([
+                        'while_statement', 'do_statement', 'for_statement', 'for_in_statement',
+                        'enhanced_for_statement', 'foreach_statement', 'for_range_loop',
+                        'switch_statement', 'switch_expression', 'expression_switch_statement',
+                        'type_switch_statement', 'select_statement',
+                        'for_expression', 'while_expression', 'loop_expression',
+                    ]);
+                    if (LABEL_CONSUMERS.has(ast.nodes[inner].type)) {
+                        ctx.pendingLabel = lname;
+                        return lowerStmt(inner, ctx);
+                    }
+                    const owner = { label: lname, target: -1 };
+                    ctx.breakT.push({ label: lname, owner });
+                    const f = lowerStmt(inner, ctx);
+                    ctx.breakT.pop();
+                    const exits = [...f.exits];
+                    for (const b of claimBreaks(owner))
+                        exits.push({ from: b.point, kind: 'break' });
+                    return { entry: f.entry, exits };
                 }
                 case 'elif_clause':
                 case 'if_statement': {

package/dist/holmes/rtm/rtm-builder.js

@@ -413,6 +413,10 @@ function addImportEdges(scanned, graph, opts) {
         else if (head === 'super') {
             baseDir = path.posix.dirname(path.posix.dirname(fromFile));
             while (segs[0] === 'super') {
+                // @implements A-SPEC-527.1 — super:: above the crate root is an rustc error; resolving
+                // it pinned '.' and produced edges to repo-root files (adversarial sweep). Refuse.
+                if (baseDir === '.' || baseDir === '/')
+                    return null;
                 segs.shift();
                 baseDir = path.posix.dirname(baseDir);
             }
@@ -447,6 +451,11 @@ function addImportEdges(scanned, graph, opts) {
         if (/\.cs$/.test(fromFile))
             return uniqueSuffix(`${spec.split('.').join('/')}.cs`);
         if (/\.(cpp|cc|cxx|hpp|h)$/.test(fromFile)) {
+            // @implements A-SPEC-527.1 — an ABSOLUTE include is not a repository coordinate: joining
+            // it into the repo frame let `#include "/etc/passwd"` match a coincidentally-shaped
+            // scanned file (adversarial sweep). Absolute means absolute; it resolves to nothing here.
+            if (spec.startsWith('/'))
+                return null;
             // extension preserved: the dotted split below would butcher `util/env.h`
             const relative = path.posix.normalize(path.posix.join(path.posix.dirname(fromFile), spec));
             if (known.has(relative))

package/dist/holmes/rtm/taint-vocabulary.js

@@ -51,7 +51,9 @@ const JAVA_VOCABULARY = {
     sanitizers: ['escapeHtml', 'quoteReplacement', 'encode'],
 };
 const CSHARP_VOCABULARY = {
-    sources: ['GetEnvironmentVariable', 'ReadLine', 'QueryString', 'Form'],
+    // @implements A-SPEC-527.1 — bare 'Form' matched every *Form identifier (WinForms world);
+    // the request-shaped spellings keep the actual web input reads.
+    sources: ['GetEnvironmentVariable', 'ReadLine', 'QueryString', 'Request.Form', '.Form['],
     sinks: ['Start', 'ExecuteReader', 'ExecuteNonQuery', 'ExecuteScalar', 'Deserialize'],
     sanitizers: ['HtmlEncode', 'UrlEncode', 'EscapeDataString'],
 };
@@ -61,7 +63,9 @@ const RUST_VOCABULARY = {
     sanitizers: ['escape', 'quote'],
 };
 const CPP_VOCABULARY = {
-    sources: ['getenv', 'argv', 'cin', 'fgets'],
+    // @implements A-SPEC-527.1 — 'cin' alone bled into English identifiers (racing, medicine…),
+    // measured by the adversarial sweep; the qualified spellings keep the real reads.
+    sources: ['getenv', 'argv', 'std::cin', 'cin >>', 'fgets'],
     sinks: ['system', 'popen', 'exec', 'execl', 'execlp', 'execle', 'execv', 'execvp', 'ShellExecute'],
     sanitizers: ['escape', 'quote'],
 };

package/package.json

@@ -1,7 +1,7 @@
 {
   "//": "@implements A-SPEC-209",
   "name": "@holmes-lab/holmes-kit",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Holmes-Kit — deterministic Agentic Software Engineering (ASE) harness with causal traceability (spec chain + D-CPG + RTM + phase guardrail)",
   "main": "dist/holmes/mcp/server.js",
   "types": "dist/holmes/mcp/server.d.ts",